01
Refuse the fake connection
A data-source selector that appears to go live without meeting its preconditions teaches an operator to trust a link that was never established.
ClearGlass Long Read // High-Trust Systems
CLEARMINE: The Dashboard That Refuses
Most industrial software fails in the same direction. It is generous with certainty and quiet about limits: a pulsing green dot for a connection that does not exist, a grade to four decimal places with no error bar, a dispatch button implying an authority the screen does not hold. Each is a small fabrication that becomes an expensive one the moment somebody commits capital to it.
What this page is: the design brief behind CLEARMINE, a ClearGlass mine-site operating picture. The public CLEARMINE workspace runs on a seeded simulator and is labelled as such throughout. No figure in it — and no figure quoted here — is site telemetry, a mineral resource estimate, or a safety reading.
Industrial UIProvenanceUncertaintyDry-runDeterminism
02
Refuse the phantom authority
A command surface that renders a dispatch button it cannot honour is training people to press it — and eventually it will be wired to something.
03
Refuse the bare number
A grade without its uncertainty and detection limit is not a measurement. It is a rounding decision presented as a fact.
The three refusals, stated on screen
CLEARMINE holds each refusal in code, at the point where the action is attempted, and says so in the interface rather than in a footnote nobody opens.
1 // Live sourceSelecting LIVE returns a stated refusal: administrator RBAC, a signed connector profile and a verified mTLS endpoint are required. Mode remains SIMULATED.
2 // CommandEquipment commands are disabled by default, require confirmation and authorisation, and resolve to a dry-run preview.
3 // PreviewEvery preview names target, simulated impact, preconditions and rollback path before anything else happens.
4 // QueueThe command lifecycle is visible: queued → authorized → dispatched → acknowledged → completed.
5 // AdapterThe hardware adapter feature flag is off, and the footer says so rather than leaving it ambiguous.
Numbers that carry their own error
The interface refuses to strip a measurement down to a headline figure:
| Reading | What travels with it |
|---|---|
| Assay grade | Uncertainty interval, detection limit, sample count, source id, chain-of-custody state, timestamp |
| Model output | Model version, inputs, pipeline stages, inference time, holdout score, calibrated confidence |
| Drill telemetry | EWMA envelope, drift against baseline, sensor freshness, quality flag |
| Scenario result | Every assumption — volume, density, grade distribution, recovery, cut-off — shown and editable |
| Gas channel | An explicit statement that it is a user interface, not a safety instrumented system |
Determinism as an honesty device
The public workspace runs a seeded pseudo-random generator across its streams, and publishes the seed. That is not a shortcut — it is a property:
- Reproducible: two people looking at the same panel see the same numbers.
- Screenshottable: a figure in a deck can be regenerated rather than argued about.
- Unmistakable: a stream that never varies between visitors cannot be mistaken for live telemetry.
- Testable: a deterministic surface has a fixed expected output, so a regression is visible.
Randomised demo data does the opposite of all four, while looking more impressive for about ten seconds.
The design rule underneath
The governed-autonomy pattern ClearGlass applies to agents — read-only analysis, then a draft, then a human decision, then execution — has an industrial equivalent, and it sits one step earlier in the chain. An agent platform asks who approves this action? An industrial surface has to ask a blunter question first: are the preconditions for this action real? If they are not, the correct behaviour is not a queued request or a disabled button with no explanation. It is a stated refusal naming what is missing.
SURFACE CONTRACT := provenance + uncertainty + preconditions + dry-run + rollback + stated refusal
That is the whole difference between a demo and an instrument. A demo is optimised to look capable. An instrument is optimised to be believed — which means it has to be willing to say no.
Where this lives
CLEARMINE is the site surface: terrain and LiDAR, drill telemetry, assay geochemistry, predictive model cards, alerts, equipment risk and the dry-run command console. Open the CLEARMINE workspace.
ORELOGIC is the programme surface: drill hole registry, core logs, assay QAQC, resource model and budget burn, with every export sealed into a verifiable hash chain. Open ORELOGIC.
Minerals Intelligence is the market surface: supply concentration, trade, policy and risk across minerals and countries. Open the Minerals Intelligence Platform.
All three are ClearGlass Inc. product surfaces running on public or simulated data. None of them produces a disclosable mineral resource estimate; that requires a Qualified Person under NI 43-101, the JORC Code, or the local equivalent.